Subject: RE: namedroppers, continued

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Fri, 6 Dec 2002 16:48:46 -0600

> Too bad nobody has ever thought of it 
> before; we  could really use the outcome 
> of that research
while researchers has not thought about global
PKI, their are research which focus on spam 
elimination.

this is the work all about (yesterday's seminar in a MIT group)

" If I don't know you, and you want your e-mail to appear in my
  inbox, then you must attach to your message an easily verified
 "proof of computational effort", just for me and just for this
 message.

If the proof of effort requires, say, 10 seconds to compute, then the
economics of sending spam are radically altered, as a single machine
can send only 8,000 messages per day.

The recent proliferation of spam has lead to a renewed interest in
these ideas.  This  work is about both the choice of
functions that can be used to yield easily verifiable proofs of
computational effort, and architectures for implementing the proof of
effort approach.  Filtering and/or forcing senders to pay in other
currencies, such as human attention and money, will be covered as time
permits"

for more details http://research.microsoft.com/research/sv/PennyBlack

---

From: Lloyd Wood <[email-masked]>
Date: Sun, 8 Dec 2002 22:29:36 +0000 (GMT)

On Fri, 6 Dec 2002, Ayyasamy, Senthilkumar  (UMKC-Student) wrote:

> If the proof of effort requires, say, 10 seconds to compute, then
> the economics of sending spam are radically altered, as a single
> machine can send only 8,000 messages per day.

tracking moore's law could be a problem.

> these ideas.  This work is about both the choice of functions that
> can be used to yield easily verifiable proofs of computational
> effort, and architectures for implementing the proof of effort
> approach.  Filtering and/or forcing senders to pay in other
> currencies, such as human attention and money, will be covered as
> time permits"

"Sender pays" is good. The penny black stamp effectively introduced a
flat-rate tax on sending letters, rather than a variable-rate tax on
receiving them, effectively turning mail into a common good available
to all society.

The government also undercut private messaging operators and
effectively put them out of business, but could use money earned
towards other services for society (having simplified and saved on its
operational costs along the way).

So, computing as a social good - you want to send an email to someone
you're unknown to, you've got to provide proof that you're
participating in SETI@home, searching for big primes, in a distributed
crypto challenge, working on processing public GIS information,
autocomparing versions of typed ascii out-of-copyright texts (or raw
CD rips?) for accuracy, processing gene data or archived NASA tapes or
otherwise doing good things -- guess this would make each computing
charity (give us your spare cycles) the ticket server or PKI manager,
although you might want to try distributing that too.

> for more details
> http://research.microsoft.com/research/sv/PennyBlack

I don't see any discussion there of the computation as a social good,
or computational functions as utility functions. Microsoft, eh?

http://www.glassinesurfer.com/f/gsrowlandhill.shtml
-- and here's the obligatory mention of Jeremy Bentham.

L.

<http://www.ee.surrey.ac.uk/Personal/L.Wood/><[email-masked]>

---

From: [email-masked]
Date: Sun, 08 Dec 2002 18:22:01 -0500

> can send only 8,000 messages per day.

Those of us who run mail servers that are currently resource-constrained
while doing 8K msgs/hour worry anytime we hear that sort of idea.
On the other hand, I wouldn't mind taking a 10-second hit every time *I*
send a message.

Possibly what is needed is a hybrid approach:

1) If you're a "big" mail server, you can probably prevail on your DNS
admins to list you in whatever DNS-based verification system (in our entire
2 /16s of address space, there are less than 10 boxes that would have a major
resource issue, but would benefit froma DNS-based solution.

2) If you're not listed in the DNS, you have to do a compute-intensive proof.

What would people think of that idea?
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 8 Dec 2002 17:02:44 -0700 (MST)

> From: [email-masked]

> ...

Is the goal to block spam?  If so, what do you do about third case of
senders that don't participate with either #1 or #2?  For the first
years, most of the 10,000,000s of legitimate SMTP clients (sending
mail servers) will do neither #1 or #2, because their operators will
not have heard about it.  You will have to configure your receiving
mail servers to require #1 or #2 only in exceptional cases.  When the
operators of the other 10,000,000s of servers finally hear about the
new regime, they'll generally to not get around to installing either
sort of proof of virtue, because their mail is working without it and
they have real problems to worry about, from installing the latest
security patches to thinking about considering IPv6.  Even people who
turn on requirements for #1 or #2 for incoming mail to reduce spam
will often delay supporting it on outgoing mail, because no one
competent likes to break things that are working.

In other words, such tactics might work for the exceptional cases of
biggest, otherwise hopeless sources of (not really) forged spam such
as Hotmail as a sort of half-blacklisting, but I can't see it working
in general.

Moore's law causes a bunch of problems for the computing idea.  There
is at at least a factor of 100 in CPU speeds of current hosts.  How
do you ensure that the fastest commodity CPU that a spammer might use
is forced to slow down more than the limit already imposed by network
bottlenecks without making old systems useless?

Vernon Schryver    [email-masked]

---

From: "Bill Cunningham" <[email-masked]>
Date: Sun, 8 Dec 2002 20:09:24 -0500

----- Original Message -----
From: "Lloyd Wood" <[email-masked]>
To: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Cc: "Fred Baker" <[email-masked]>; "Hallam-Baker, Phillip"
<[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: Sunday, December 08, 2002 5:29 PM
Subject: RE: namedroppers, continued

> receiving them, effectively turning mail into a common good available

Lloyd, in the US we pay .37 to mail a first-class letter. I don't know how
many pence you pay in the UK but we still have "spam" bulk rate unwanted
solicitations. Forcing the sender to pay doesn't solve a spam problem. I
don't see how in could. It would force everyone to have to pay a price.

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 9 Dec 2002 03:14:43 +0000 (GMT)

On Sun, 8 Dec 2002, Dean Anderson wrote:

> On Sun, 8 Dec 2002, Lloyd Wood wrote:
> You assume this really means "the spammer pays" [more].

that quote is excerpted out of context.

> But that isn't the case.  This is based on the myth that somehow the
> receiver pays the entire cost of a spam message. This isn't true,
> and never was true.

It's true. It's an attention economy, where the recipients' lives and
time are finite. But placing a value on time is tricky.

> The sender is already paying, whether they are spammer or mailing
> list operator, or regular end user.  The fact is that email is so
> cheap that it costs almost nothing per message to send and receive.
> It gets cheaper every day, as disks and bandwidth get cheaper and
> cheaper. The receiver doesn't pay any more than the sender pays.

only if a purely fiscal definition is taken.

> Real commercial spam happens because the cost of sending spam is
> less than the cost of sending letters or postcards.

this is very true. It's also true for physical commercial bulk mail,
which gets special rates compared to individual letters or postcards.

Bill Cunningham adds:

$ Lloyd, in the US we pay .37 to mail a first-class letter. I don't
$ know how many pence you pay in the UK but we still have "spam" bulk
$ rate unwanted solicitations.

...that are paid for at commercial bulk rates vastly cheaper than the
individual rate, which encourages them. That's what you get for
running the postal service as a commercial business rather than as a
emphasising the social good aspects.

$ Forcing the sender to pay doesn't solve a spam problem.  I don't see
$ how in could. It would force everyone to have to pay a price.

if everyone pays the same price, then those sending the most are most
penalised. flat-rate.

> If you artificially made email expensive, it would be expensive for
> list operators and regular people as well. You mentioned a rate of
> one cent per message.

I did not mention such a rate; you've taken the Penny Black
one-penny-over-150-years-ago and run with it. Perhaps you would care
to actually read my entire message, and tailor your canned rant to it?

The act of subscribing to a list indicates that you know the list, and
you're less likely to reject mail from people you don't know that
comes or also comes via the list, since you're interested in reading
that list -- unless the list is a simple exploder with no filtering
mechanisms itself, in which case, subscribers pester each other
(rather than the list) for computational proofs until the list
implements spam filtering.

L.

> That would not be enough to deter spam. A rate of ten cents per
> message would still be cheaper than postal mail, and so spammers would
> still exist.  Much non-commmercial spam is sent by KLEZ or Nimda viruses.
> This sort of abuse would not be affected whatsoever.  Note that KLEZ
> infections are already illegal.
>
> Think how much it would cost to send out namedroppers, (and the entire
> bulk of IETF standards related email) if each message to each recipient
> cost, say $0.10.  Or even one cent per message per recipient.  This
> proposal would essentially wipe out many if not most mailing list
> operators, and most ISPs.
>
> I made a proposal back in 1997 that would not eliminate spam, but would
> keep it out of your mailbox. My proposal was rejected because radicals
> demanded a complete ban on spam. In 1998, there was an opportunity to get
> anti-spam legislation passed.  Unreasonable anti-spam radicals passed up
> that opportunity when they insisted on unrealistic demands, and
> exaggerated and factually wrong assertions about the cost of spam.  They
> assumed they could "shout down" any opposition, as they shouted down more
> reasonable proposals.  They were understandably and easily crushed by the
> Direct Marketing Association (DMA).  You can still see my proposal at
> http://www.av8.com/H.4581/better.html This proposal would have been
> difficult for the DMA to challenge since they already accept these
> restrictions on postal mail.  You have the radical anti-spam leadership to
> thank for your spam, and the fact that you don't have a universal opt-out
> list.
>
> The anti-spam effort was for all practical purposes completely crushed
> when Exactis successfully sued MAPS and demonstrated that blacklists are
> subject to the Sherman Anti Trust Act and that blacklists weren't
> protected by the First Amendment.  I told Vixie this would happen in 1997.
> He assured me that anti-spammers could win by technical means. If it
> wasn't clear that he was wrong in 1997, (and it seemed pretty obvious even
> then), it is now painfully obvious that Vixie and the rest were very
> wrong.
>
> It is really time for new, reasonable, anti-spam leadership, not artifical
> changes to the cost of email, or schemes to try to make sending mail more
> expensive for the senders, and certainly not gyrations in the sending of
> namedroppers.
>
> Thanks to the ineptitude, lack of foresight, irrationality, and general
> unreasonableness of the anti-spam leadership, spam is here to stay. It is
> just a matter of degrees of how bad it will be.  I note there is some
> legislation before the house and senate (HR 1017) on spam control, that
> reportedly isn't opposed by the DMA. However, these only control
> fraudulent spam.  HR 1017 proposes extensions of 18 USC 1030, which makes
> it a fraudulent spam a crime, but the FBI probably won't bring charges for
> small violations. There is no provision for a civil action.
>
> Another bill (S.630) would require each spammer to maintain an opt-out
> list.  You would have to contact each spammer, and have your email address
> added to their list, one by one. There would be thousands of spammers to
> contact.
>
> Note that my proposal would had a single opt-out list (the Post Office
> already maintains such a list for postal junk mail), and my proposal
> probably could have been passed into law in 1998.
>
> 		--Dean
>
>

---

From: [email-masked]
Date: Sun, 08 Dec 2002 23:09:35 -0500

On Sun, 08 Dec 2002 17:02:44 MST, Vernon Schryver <[email-masked]>  said:

> not have heard about it.

The bootstrap problem will exist no matter what scheme we decide on.

The point I was addressing was that there's been two major classes of
scheme proposed so far, with interesting characteristics:  at least for my
user community, each class (local computation and DNS) of proposal will
work very nicely for one subset of my users, and create major hassles for the
complementary subset.

However, the partitions created by each scheme are quite complementary,
so although I can't support a "be registered in DNS" solution because it
will not cover my desktop/roaming users, and I can't support a "use resources"
solution because it breaks my large servers, I *can* support a "either A or B"
scheme, as I have essentially no systems that couldn't do either one (at least
in theory, assuming software is available).

> bottlenecks without making old systems useless?

I'm still pondering that one. ;)

It may not be as big of a problem as we think.  Rough back-of-envelope
calculations now:  Let's say we assume a function X designed to take 10
seconds of CPU on my laptop (which has a 1.6Gz P-4 in it) to limit it to 8K
messages/day. Now, this same function will take around 2 minutes on a 133mz
processor and be restricted to 800 mails/day.  And yes, a spammer with a
100-node Beowolf could still send 800K mails/day, but the cost of the cluster
changes the economics considerably.

Now how many people are still using a 133 system to do that much outbound mail
themselves (and *NOT* just relaying all outbound mail to a smarthost)?  And
even *MORE* to the point, what are the chances that a system that old will be
upgraded software-wise to support a scheme, even if it takes zero additional
CPU? I strongly suspect that the *big* issue in getting said box to play nice
won't be the CPU, it will be trying to find a way to upgrade whatever
creeping-horror bletchware mailer they're using on Windows 3.1 ;)

---

From: [email-masked]
Date: Sun, 08 Dec 2002 23:12:57 -0500

> don't see how in could. It would force everyone to have to pay a price.

On the flip side, although I still receive a fair number of postal bulk
rate advertisements, they differ in several respects from e-mail spam:

1) They tend to be much more targeted, and as a result more likely to be
of interest.  I get flyers from local supermarkets that I don't actually
shop at, but at least I don't get flyers for supermarkets 3 time zones away.

2) The cost per item tends to keep the total volume down.

3) Almost all the postal advertisements I receive are for legitimate groups
who wish to engage in legitimate business (or sometimes charity) transactions.
Very little of the e-mail spam strikes me as legitimate....

The price-per-item is the main driving force on all three (although with the
third, the fact that large-scale fraud via the mails can get you prison time
helps control that problem as well).

Remember - in 6,000 years (and probably longer) we have yet to find a way to
totally stop scams and con artists.  However, we've gotten fairly good at
at least curtailing their activities to the point that society can function.

We don't need a 100% perfect anti-spam solution.  Like most societal ills,
if we can fix 98% of it, we can move on.
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 8 Dec 2002 22:09:16 -0700 (MST)

> The bootstrap problem will exist no matter what scheme we decide on.

There are many spam solutions that do not have the bootstrapping
problem.  Examples include effective laws and honest intent and action
by ISPs.  Before saying those are hopeless, please note that the many
bootstrap-limited proposals don't have proven prospects.

> scheme proposed ...

> However, the partitions created by each scheme are quite complementary,

Your observation of how those two solutions fit together is
interesting...or would be if they did not suffer from other problems.

> ...
> > Moore's law causes a bunch of problems for the computing idea. ...

> messages/day.

http://www.intel.com/home/desktop/pentium4/ suggests state of the commodity
art is about twice that, which lets a spammer send 16K msgs/day. 
Moore's law is still a treadmill that you don't want to fight.

>               Now, this same function will take around 2 minutes on a 133mz
> processor and be restricted to 800 mails/day. ...

I would put the lower limit at around 48 MHz on 80486s, or ~8 times
slower than a 133 MHz Pentium.  Such machines go back less than 10 years. 
Would you expect your conservative correspondents to spend 15 minutes
to send you a message, or would you just white-list them? 
Once you start white-listing, it's hard to have much enthusiasm for
more fancier solutions.

> themselves (and *NOT* just relaying all outbound mail to a smarthost)?

I think recent FreeBSD and sendmail would still work fine at 48 MHz,
although you probably want to stuff the thing to the gills with 64 MByte
of RAM, or more if it can take it.  There are many computing tasks that 
don't need 3 GHZ and 3 GByte.

Aren't busy smarthosts significantly busier than 80K msgs/day?
From my old experience, that was true even when they were running
at less than 50 MHz and with perhaps 100 MByte.

Besides, no matter what inmates of glass houses and big ISPs would
have you think, SMTP is a peer-to-peer protocol.  A major damage spam
is doing is helping government commissars and ISP salescritters convince
people that the ancient Compuserve/AOL/Prodigy/whatever dumb-terminal-
connected-to-central-servers is the only way to do public networking
and computing.

                                                                          And
> CPU? ...

Would you whitelist it for the next 10 years?  If there are very
few, white-listing works.  If not, you've got that bootstrapping problem,
and you've invited the white-listing camel into your tent.

---

From: "Bill Cunningham" <[email-masked]>
Date: Mon, 9 Dec 2002 00:47:45 -0500

How about passing a law that makes eveyone install a BIOS patch to block out
spam. ;-)

    On the serious side Vernon has a point. Even with snail mail you can go
to the post office and the USPS will provide you with a form to fill out and
they will not put advertisements into your mail. If ISPs would only do the
same. As of yet, if all else fails, deleting a email box is easier and more
effective than taking a ballbat to a snail mail box.

    --Bill
----- Original Message -----
From: "Vernon Schryver" <[email-masked]>
To: <[email-masked]>
Sent: Monday, December 09, 2002 12:09 AM
Subject: Re: namedroppers, continued

And

---

From: [email-masked]
Date: Mon, 09 Dec 2002 00:43:26 -0500

> implements spam filtering.

Let's look at some of the headers of the message I'm replying to:

Received: from fan.cc.vt.edu [198.82.161.8] 	by localhost with POP3 (fetchmail-5.9.0) 	for valdis@localhost (single-drop); Sun, 08 Dec 2002 22:41:03 -0500 (EST)

This is where my laptop picked up my mail via POP3.  My laptop can be aware of
the fact that I'm subscribed to IETF.  However, this is too late to make the
check effectively - it's already hit our central mail server.

Received: from steiner.cc.vt.edu ([10.1.1.14])  by gkar.cc.vt.edu (Sun Internet Mail Server sims.3.5.2001.05.04.11.50.p10)  with ESMTP id <[email-masked]>; Sun,  8 Dec 2002 22:43:06 -0500 (EST)
Received: from loki.ietf.org (loki.ietf.org [132.151.1.177])  by steiner.cc.vt.edu (Mirapoint Messaging Server MOS 3.2.1-GA)  with ESMTP id ATX04442; Sun, 08 Dec 2002 22:42:56 -0500 (EST)

Unfortunately, steiner is the machine which *should* be doing the filtering
(in fact, it's one of our front-end virus scanners).  But there's no good way
for it to know what I'm subscribed to - and a good case can be made that often
the mail server should *not* know what I'm subscribed to (for privacy reasons).

You *could* sell me on a concept where I tell the mail server "accept any mail
that presents a token that hashes to <this>", where I provide a test that
doesn't provide any information regarding the sender.

Why?  Because I don't trust my government to resist the temptation. (Nor do I
trust any OTHER national goverment, for that matter).
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Mon, 09 Dec 2002 01:12:23 -0500

> How about passing a law that makes eveyone install a BIOS patch to block out

There exist systems that don't have a BIOS. ;)

(Making this reply mostly because there's been serious DRM proposals
that have this same exact problem).

---

From: Dean Anderson <[email-masked]>
Date: Sat, 7 Dec 2002 12:18:27 -0500 (EST)

This seems clever, however, it will also take significant computational
effort to verify the computational effort was actually done. Even if a
class of functions are found that are "easier" to verify than to compute,
they will no doubt still take up a significant fraction of time.

Also, all outgoing messages would need this computation, since a
mailserver does not know who it has sent mail to in the past, and whether
they are still in receipt of the verification.  So then you would only be
able to send 8000 messages a day, too.

Clearly, that doesn't scale very well.

It seems unlikely that this would change the percentage of spam, since it
would merely reduce the total amount of mail sent.

I haven't observed a recent proliferation of spam, however. Spam seems to
be level.

		--Dean

On Fri, 6 Dec 2002, Ayyasamy, Senthilkumar  (UMKC-Student) wrote:
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
>

---

From: Ketil Froyn <[email-masked]>
Date: Sun, 8 Dec 2002 18:13:43 +0100 (CET)

> can send only 8,000 messages per day.

Wouldn't something like this cause problems for (large/free) email
providers?  They would probably need a lot of extra hardware to do all
this computation. And until something like this is included in the
standard, the receiver must accept mail from senders that don't implement
this yet.

I personally like the idea behind qconfirm (http://smarden.org/qconfirm/)
and TMDA (http://tmda.net/). If I receive an email that I do not recognize
or otherwise find to be authentic, a mail is sent back to the sender,
requesting that they send a verification mail to a unique secret address.
When a mail is received at this secret address, the original mail is
delivered to me, and the secret address is removed. For a spammer, it is
too expensive to receive and reply to all these mails.

Ketil

---

From: Dean Anderson <[email-masked]>
Date: Sun, 8 Dec 2002 19:34:10 -0500 (EST)

> receiving them, effectively turning mail into a common good available

You assume this really means "the spammer pays" [more]. But that isn't the
case.  This is based on the myth that somehow the receiver pays the entire
cost of a spam message. This isn't true, and never was true. The sender is
already paying, whether they are spammer or mailing list operator, or
regular end user.  The fact is that email is so cheap that it costs almost
nothing per message to send and receive.  It gets cheaper every day, as
disks and bandwidth get cheaper and cheaper. The receiver doesn't pay any
more than the sender pays. Real commercial spam happens because the cost
of sending spam is less than the cost of sending letters or postcards.

If you artificially made email expensive, it would be expensive for list
operators and regular people as well. You mentioned a rate of one cent per
message.  That would not be enough to deter spam. A rate of ten cents per
message would still be cheaper than postal mail, and so spammers would
still exist.  Much non-commmercial spam is sent by KLEZ or Nimda viruses.
This sort of abuse would not be affected whatsoever.  Note that KLEZ
infections are already illegal.

		--Dean

---

From: "Bill Cunningham" <[email-masked]>
Date: Mon, 9 Dec 2002 17:49:03 -0500

I haven't personally tried myself to opt out. But I've read they have the
form. If they told you they don't have a form to sort out junk mail for you
I'd say they were full out it. I'd call the Postmaster General's office.

----- Original Message -----
From: "Stephen Sprunk" <[email-masked]>
To: "Bill Cunningham" <[email-masked]>
Sent: Monday, December 09, 2002 12:56 PM
Subject: Re: namedroppers, continued

> Can you tell me where to get this form?  When I spoke to the USPS, they
said
> they're legally obligated to deliver all junk mail addressed to me,
> regardless of whether I want it.
>
> Now, the DMA (not the USPS) does have an opt-out list you can join, but
> unfortunately that only drops about half the junk mail I get -- many local
> mailers don't join the DMA because of cost.
>
> S
>
>
> Bill Cunningham wrote:
> > How about passing a law that makes eveyone install a BIOS patch to
> > block out spam. ;-)
> >
> >     On the serious side Vernon has a point. Even with snail mail you
> > can go to the post office and the USPS will provide you with a form
> > to fill out and they will not put advertisements into your mail. If
> > ISPs would only do the same. As of yet, if all else fails, deleting a
> > email box is easier and more effective than taking a ballbat to a
> > snail mail box.
> >
> >     --Bill
> >> problem.  Examples include effective laws and honest intent and
> >> action by ISPs.  Before saying those are hopeless, please note that
> >> the many bootstrap-limited proposals don't have proven prospects.
> >>
> >>> The point I was addressing was that there's been two major classes
> >>> of scheme proposed ...
> >>
> >>> However, the partitions created by each scheme are quite
> >>> complementary, ...
> >>
> >>> It may not be as big of a problem as we think.  Rough
> >>> back-of-envelope calculations now:  Let's say we assume a function
> >>> X designed to take 10 seconds of CPU on my laptop (which has a
> >>> 1.6Gz P-4 in it) to limit it to 8K messages/day.
> >>
> >> http://www.intel.com/home/desktop/pentium4/ suggests state of the
> >> commodity art is about twice that, which lets a spammer send 16K
> >> msgs/day. Moore's law is still a treadmill that you don't want to
> >> fight.
> >>
> >>>               Now, this same function will take around 2 minutes on
> >>> a 133mz processor and be restricted to 800 mails/day. ...
> >>
> >> slower than a 133 MHz Pentium.  Such machines go back less than 10
> >> years. Would you expect your conservative correspondents to spend 15
> >> minutes to send you a message, or would you just white-list them?
> >>> Now how many people are still using a 133 system to do that much
> >>> outbound mail themselves (and *NOT* just relaying all outbound mail
> >>> to a smarthost)?
> >>
> >> although you probably want to stuff the thing to the gills with 64
> >> MByte of RAM, or more if it can take it.  There are many computing
> >> tasks that don't need 3 GHZ and 3 GByte.
> >>
> >> is doing is helping government commissars and ISP salescritters
> >> convince people that the ancient Compuserve/AOL/Prodigy/whatever
> >> dumb-terminal- connected-to-central-servers is the only way to do
> >> public networking and computing.
> >>
> >>
> > And
> >>> even *MORE* to the point, what are the chances that a system that
> >>> old will be upgraded software-wise to support a scheme, even if it
> >>> takes zero additional CPU? ...
> >>
> >> few, white-listing works.  If not, you've got that bootstrapping
> >> problem, and you've invited the white-listing camel into your tent.
> >>
> >>
>      |          |         Stephen Sprunk, K5SSS, CCIE #3723
>     :|:        :|:        Network Design Consultant
>    :|||:      :|||:       Cisco Advanced Services
> .:|||||||:..:|||||||:.    Richardson, Texas, USA
>

---

From: John C Klensin <[email-masked]>
Date: Mon, 09 Dec 2002 21:16:49 -0500

--On Monday, 09 December, 2002 17:49 -0500 Bill Cunningham
<[email-masked]> wrote:

> I haven't personally tried myself to opt out. But I've read
> they have the form. If they told you they don't have a form to
> sort out junk mail for you I'd say they were full out it. I'd
> call the Postmaster General's office.

Bill,

For the US Post Office, they don't have the form.  In another
context, I've been over this with the Postal Inspection Service.
They have two other forms and models, one of which is probably
getting confused with this.

(1) You can decline to receive the particular form of junk mail
that is addressed to "occupant", "boxholder", or similar generic
terms.  For that, there is a form.

(2) You can also decide that particular types of materials,
identifed by specific description (nearly impossible in most
cases) or source is obscene.  Once you do that, and perform the
relevant rituals, it becomes illegal for identified sources to
send the stuff to you.  In general, you can't get the post
office to open all of your mail and do content filtering to be
sure it doesn't meet your criteria for obscenity.   And you
probably wouldn't want to, since that would require authorizing
them to open and read all of your mail.  But it can be an
effective way to prevent a particular sender for sending you
specific kinds of materials, since the penalties for sending
obscene materials through the mails are quite severe.

If it is addressed to you, by name and matching address, they
are, as Stephen indicated, legally required to deliver it
(unless it falls under the prohibitions of (2) above).  So,
oddly, you can opt out of "untargeted" mailings, but not out of
"targeted" ones.

    john

---

From: "Bill Cunningham" <[email-masked]>
Date: Mon, 9 Dec 2002 23:22:59 -0500

----- Original Message -----
From: "John C Klensin" <[email-masked]>
To: "Bill Cunningham" <[email-masked]>
Cc: "Stephen Sprunk" <[email-masked]>; <[email-masked]>
Sent: Monday, December 09, 2002 9:16 PM
Subject: Re: namedroppers, continued

> oddly, you can opt out of "untargeted" mailings, but not out of

I checked 39USC and 39CFR955 I guess the postal service maintains a list if
you want to not receive mailing for sexually oriented materials,
sweepstakes, and pandering solicitations. But that's about it. As far as the
USPS goes.

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 10 Dec 2002 09:29:54 -0500

> sweepstakes, and pandering solicitations. But that's about it. As far as the

I have not yet tried filing a form 1500, but, if you believe the folks
at junkbusters.com [1] [2], and page 13 of Postal Bulletin 21977 [3],
it's clear that the courts have ruled that porn is in the eye of the
beholder.

  "Postmasters may not refuse to accept a Form 1500 because the
   advertisement in question does not appear to be sexually
   oriented. Only the addressee may make that determination."

						- Bill

[1] http://www.junkbusters.com/self.html#prohibit
[2] http://www.junkbusters.com/dmlaws.html
[3] http://www.usps.com/cpim/ftp/bulletin/1998/pb21977.pdf

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 8 Dec 2002 17:02:44 -0700 (MST)

---

From: Lloyd Wood <[email-masked]>
Date: Mon, 9 Dec 2002 03:14:43 +0000 (GMT)

Bill Cunningham adds:

L.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 8 Dec 2002 22:09:16 -0700 (MST)

And